geoskill-hotspot-analysis

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:32 PM UTC
• Version: 1.0.0

Overview

The documented hotspot tool is mostly local, but the package also includes undisclosed network, download, and credential-handling code that should be reviewed before installation.

Treat this as a review-needed package: the documented command path appears to run local hotspot analysis, but install it only if you are comfortable with the extra bundled geocoding, download, and credential modules. Prefer an isolated environment, remove or disable unused helper modules, remove/rotate the embedded Earthdata credentials, and pin dependency versions before operational use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares itself as offline/local-only, yet the static analysis detected capabilities for environment access, file read/write, shell, and network without any declared permissions. That mismatch weakens user consent and trust boundaries because a caller may grant or execute the skill assuming it cannot access sensitive local or external resources when it potentially can.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a strong description-behavior mismatch: the skill is presented as a local geospatial hotspot analysis tool, but analysis indicates additional functionality for online geocoding, HTTP access, downloading, credential management, and even hardcoded default Earthdata credentials. Hidden network access and embedded credentials materially expand the attack surface, enabling data exfiltration, unauthorized remote access, or abuse of third-party accounts beyond the user's reasonable expectations.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The vendored metadata declares the embedded component as 'landsat-download' even though the skill is presented as hotspot analysis. This capability mismatch is dangerous because it can conceal undeclared behavior, expand the attack surface, and mislead reviewers or operators about what code is actually present and allowed to run.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The listed vendored files include functionality such as 'safe_download.py', 'credentials.py', and sensor/AOI handling, which suggests satellite data acquisition capability beyond pure hotspot analysis. In this context, undeclared download and credential-related code is risky because it may enable unexpected network access, data exfiltration paths, or privileged operations not anticipated by users of an analysis-only skill.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: The public resolve_place API exposes and defaults to external geocoding behavior, sending user-supplied place names to third-party services as part of normal operation. For a skill described as hotspot/KDE/significance analysis, this expands capability beyond the stated purpose and creates an undeclared data egress/privacy risk, especially when user inputs may contain sensitive locations.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The legacy implementation contains built-in network geocoding against Open-Meteo and Nominatim, which is not obviously necessary for the declared analytical function and broadens the trust boundary to external providers. This can leak operational inputs, create compliance issues, and make analysis behavior dependent on remote services outside the user's control.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: User-supplied place names are sent to third-party geocoding services, which can expose potentially sensitive operational or location-related queries without explicit notice or consent. In a geospatial analysis skill, AOI names may encode private client sites, incidents, or investigative targets, so undisclosed transmission creates a real privacy and data-handling risk even though there is no direct code-execution flaw.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module hardcodes a real-looking Earthdata username and password as fallback defaults in source code. Hardcoded credentials are dangerous because anyone with code access can recover them, and any execution path that falls back to defaults may silently authenticate to an unintended account, enabling account abuse, unauthorized data access, or credential reuse attacks.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code directly transmits user-provided place queries to external geocoding endpoints via HTTP requests without any visible disclosure, consent flow, or warning at the API boundary. Place names can reveal sensitive intent, travel, assets, or incident locations, so silent transmission to third parties creates a real privacy and data-handling risk.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The Nominatim request hard-codes Accept-Language to zh-CN/zh regardless of user preference, which can alter returned results and unnecessarily disclose locale assumptions to the third party. While not a severe exploit vector by itself, it is an unjustified privacy and behavior-control issue that can bias resolution and surprise users.

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 98% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas

• Confidence: 97% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 97% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 98% confidence
• Finding: scipy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 98% confidence
• Finding: geopandas

Unpinned Dependencies

Low

• Category: Supply Chain

Content

rasterio
scipy
geopandas
shapely

• Confidence: 96% confidence
• Finding: shapely

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: scipy

Known Vulnerable Dependency: geopandas — 2 advisory(ies): CVE-2025-69662 (geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclos); CVE-2025-69662 (SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to ob)

Critical

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: geopandas

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15